Trust management in transaction systems, such as those using payment cards as transaction devices, has long been a complex technical issue of great commercial importance. As the subversion of transaction systems by malicious third parties has the potential to compromise significant financial assets, it is very important for all points of potential weakness in a transaction system to be protected by appropriate trust mechanisms. In a transaction system using payment cards or other payment devices, for example using the EMV protocols, as transaction devices, this will require appropriate safeguards for individual cards and devices, for terminals, and for the other elements of the transaction system.
EMV is a financial transaction system based around the use of contact and contactless transaction cards. In the EMV payment model, an issuing bank provides an account holding customer with a smart card (or other token) to use when making payments. An acquiring bank provides a merchant with a compatible terminal device to use when accepting payments. The term “terminal” here is considered to cover any device that interfaces directly with such a transaction card (e.g. an interface allowing user entry of a personal identification number (PIN) such as a PIN pad or PIN Entry Device (PED), or a POS terminal or ATM device comprising means such as these, to allow interaction with a transaction card).
Trust management becomes extremely challenging when some system elements (payment cards and even terminals) are only intermittently in contact with the main transaction system, and when it may be necessary for one system element to interact with another system element without a full assurance that this further system element is trustworthy. This may apply, for example, in conflict regions or after a natural disaster, or any other circumstance in which normal communication networks such as the wired or wireless telecommunications infrastructure may be wholly or partially disabled.
Transaction systems using the EMV standards will support offline transactions between a payment card or device and a terminal even when the terminal is not in communication with the main transaction system. Such transactions clearly have added risk as the risk management services provided by the main transaction system are not available, and such financial risk cumulates over time and number of transactions. It is strongly preferable to require terminals and payment devices to make an online connection to the main transaction system sufficiently regularly to control this financial risk. This requirement, however, is difficult to achieve for a conventional transaction card.